From 618a5ec8b1fa739863ea50ccee0e6eeb8d35ff8d Mon Sep 17 00:00:00 2001
From: Andre Manoel <amanoel@nvidia.com>
Date: Tue, 14 Jul 2026 19:42:26 -0300
Subject: [PATCH 1/2] fix(agentic-ci): report authorized DCO status

---
 .github/workflows/agentic-ci-authorized-checks.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/agentic-ci-authorized-checks.yml b/.github/workflows/agentic-ci-authorized-checks.yml
index 0db32cf6f..938556056 100644
--- a/.github/workflows/agentic-ci-authorized-checks.yml
+++ b/.github/workflows/agentic-ci-authorized-checks.yml
@@ -15,6 +15,7 @@ on:
 permissions:
   contents: read
   pull-requests: read
+  statuses: write
 
 concurrency:
   group: agentic-ci-authorized-checks-${{ inputs.pr_number }}
@@ -84,7 +85,10 @@ jobs:
     steps:
       - name: Validate authorization
         env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ inputs.expected_head_sha }}
           PR_RESULT: ${{ needs.pr.result }}
+          REPO: ${{ github.repository }}
           TRUSTED: ${{ needs.pr.outputs.trusted }}
         run: |
           if [ "$PR_RESULT" != "success" ] || [ "$TRUSTED" != "true" ]; then
@@ -93,6 +97,12 @@ jobs:
           fi
           echo "Trusted Agentic CI PR authorized by a maintainer."
 
+          gh api --method POST "repos/${REPO}/statuses/${HEAD_SHA}" \
+            -f state=success \
+            -f context=DCOAssistant \
+            -f description="Trusted Agentic CI PR authorized by a maintainer." \
+            -f target_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+
   semantic-pull-request:
     name: semantic-pull-request / semantic-pull-request
     needs: pr

From aa04e721ce6feb554974d269f1cc8d8f98f5e098 Mon Sep 17 00:00:00 2001
From: Andre Manoel <amanoel@nvidia.com>
Date: Wed, 15 Jul 2026 10:22:20 -0300
Subject: [PATCH 2/2] fix(agentic-ci): harden authorization

Limit commit-status writes to the DCO authorization job.

Require dispatched workflow definitions to match main before launch.
---
 .github/workflows/agentic-ci-authorized-checks.yml | 3 ++-
 .github/workflows/authorize-agentic-ci.yml         | 9 +++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/agentic-ci-authorized-checks.yml b/.github/workflows/agentic-ci-authorized-checks.yml
index 938556056..b6d8ef651 100644
--- a/.github/workflows/agentic-ci-authorized-checks.yml
+++ b/.github/workflows/agentic-ci-authorized-checks.yml
@@ -15,7 +15,6 @@ on:
 permissions:
   contents: read
   pull-requests: read
-  statuses: write
 
 concurrency:
   group: agentic-ci-authorized-checks-${{ inputs.pr_number }}
@@ -80,6 +79,8 @@ jobs:
   DCOAssistant:
     needs: pr
     if: always()
+    permissions:
+      statuses: write
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/authorize-agentic-ci.yml b/.github/workflows/authorize-agentic-ci.yml
index c61773e27..96772b8ec 100644
--- a/.github/workflows/authorize-agentic-ci.yml
+++ b/.github/workflows/authorize-agentic-ci.yml
@@ -171,6 +171,15 @@ jobs:
             exit 1
           fi
 
+          for WORKFLOW_PATH in .github/workflows/ci.yml .github/workflows/agentic-ci-authorized-checks.yml; do
+            MAIN_WORKFLOW_SHA=$(gh api "repos/${REPO}/contents/${WORKFLOW_PATH}?ref=main" --jq '.sha')
+            HEAD_WORKFLOW_SHA=$(gh api "repos/${REPO}/contents/${WORKFLOW_PATH}?ref=${HEAD_SHA}" --jq '.sha')
+            if [ "$HEAD_WORKFLOW_SHA" != "$MAIN_WORKFLOW_SHA" ]; then
+              comment "Agentic CI checks were not authorized because ${WORKFLOW_PATH} does not match main. Update the PR branch and try again."
+              exit 1
+            fi
+          done
+
           echo "Authorizing checks for ${HEAD_SHA}."
 
       - name: Dispatch checks